📰 Dev.to · BeyondMachines

Security researcher Nightmare Eclipse released the HardBreacher exploit, a zero-day privilege escalation flaw in Kaspersky Endpoint Security that allows attacke

Orient Blackswan, a publishing house in Hyderabad, suffered a ransomware attack that encrypted business data and disrupted their IT infrastructure. The company

Jasper-Newton Electric Cooperative notified the Texas Attorney General of a cyberattack that exposed the Social Security and driver’s license numbers of at leas

WPMU DEV patched two critical vulnerabilities in its Dashboard plugin, including an actively exploited CVSS 9.8 authentication bypass that allows unauthenticate

GiveWP released a security update to fix a maximum-severity vulnerability (CVE-2026-82222) that allows unauthenticated attackers to execute remote code and take

A new Shai-Hulud malware variant called Trinitite compromised the @7nohe/openapi-react-query-codegen npm package, affecting over 128,000 weekly downloads. The m

Micro-Comm Inc. suffered a ransomware attack by the Barracuda group that resulted in the theft of 644 GB of data, including technical diagrams and government cu

LazyOwn RedTeam/APT Framework patched a critical vulnerability (CVE-2026-68503) that allows attackers to gain full administrative control over C2 dashboards usi

Gitea patched a critical remote code execution vulnerability (CVE-2026-60004) that attackers are actively exploiting to install crypto-miners on self-hosted ins

During the week of Aug. 17–24, 2026, there were 16 advisories and 34 incidents (advisories up from 9, incidents down from 42 the prior week), affecting roughly

Iranian-affiliated hackers linked to the IRGC disabled a small UK power plant for four days in July 2026 by exploiting internet-exposed industrial controllers.

Elementor Pro versions before 4.2.2 contain a critical logic flaw in the file upload module that allows unauthenticated attackers to bypass extension filters an

UMC Utrecht suffered a data breach affecting 5,000 guesthouse visitors after an unauthorized actor compromised its third-party booking provider, VIPS PMS. The s

WPMU DEV patched a critical vulnerability (CVE-2026-15748) in the Forminator Forms plugin that allowed unauthenticated attackers to upload and execute PHP files

Attackers began probing CVE-2026-71362 (CVSS 9.1), a critical incorrect-authorization flaw in Adobe Commerce, B2B, and Magento Open Source almost immediately af

Paperclip patched three critical vulnerabilities, including a CVSS 10.0 RCE flaw, that allow attackers to take over AI agent servers and local development machi

CISA reports active exploitation of an Apache Tomcat vulnerability (CVE-2026-34486) to its KEV catalog after Chinese threat actors exploited a fail-open logic e

IBM Langflow OSS injection vulnerability (CVE-2026-9198)is actively exploited. CISA has added the flaw to its Known Exploited Vulnerabilities catalog and requir

A vulnerability chain in Azure Cosmos DB's Gremlin API allowed attackers to escape sandboxes, steal a platform-wide master key, and gain full read/write access

Amgen Inc. suffered a material data breach in July 2026 after attackers exfiltrated patient health information and proprietary corporate data from third-party c

Love, Bonito reports a website vulnerability on July 26, 2024, that allowed unauthorized access to customer names, contact details, and partial payment informat

Kootenai County disclosed a ransomware attack that compromised residents’ personal information, including Social Security numbers, financial details, and finger

Adobe patched a high-severity vulnerability dubbed HermeticReader (CVE-2026-48294) in its Acrobat Chrome extension that allowed malicious websites to silently s

Chick-fil-A suffered a credential stuffing attack in June 2026 where unauthorized parties used stolen third-party credentials to access loyalty accounts and exp